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REMARKS/ARGUMENTS 

This amendment is responsive to the Office Action mailed on January 22, 2008. In the 
Office Action, Claims 1-8 and 10-34 are rejected. In this amendment, no claims are added, 
amended, or canceled. Thus, after entry of this amendment, Claims 1-8 and 10-34 are pending 
and subject to examination on the merits. 

On April 2, 2008 a telephonic interview was held between Examiners Zand, Bayou, and 
the undersigned. During the interview, the various message passing transactions that occur in the 
cited references and the present application were discussed. Particularly, the messages regarding 
requesting passcode authentication and receiving requests for passcode authentication were 
discussed. Additionally, the entry of a passcode into a front end HSM was discussed and 
clarified. The Examiners appeared to be persuaded that manually entering a passcode into a 
device is not entering the passcode in an encrypted format, although they requested further 
clarification in this response. The Examiners further provided a suggestion to clarify the claim 
language with regard to "Hardware Security Module" to indicate it is hardware. The undersigned 
thanks the Examiners for their time and their careful consideration of the arguments presented. 

Claim Rejections 35 USC $ 102(b), Hodgson 

Claims 1-8, 10-17, 19-20, and 22-32 are rejected as being anticipated by Hodgson 
et al. (U.S. Patent Pub. No. 2002/0 \23972)(" Hodgson"). The Office Action alleges that 
Hodgson teaches each and every limitation in these claims. This rejection is traversed. 

Anticipation has not been established because each and every limitation is not 
taught by Hodgson. "A claim is anticipated only if each and every element as set forth in the 
claim is found, either expressly or inherently described, in a single prior art reference." 
Verdegaal Bros. v. Union Oil Co. of California, 814 F.2d 628, 631, 2 USPQ2d 1051, 1053 (Fed. 
Cir. 1987). MPEP2131. 
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Claim 1 

Each and every limitation of Claim 1 is not disclosed by Hodgson. For example, Claim 1 

recites: 

an Access Control Server (ACS) configured to receive a request for passcode 
authentication of a Primary Account Number (PAN), and configured to request a 
passcode corresponding to the PAN 

The Office Action alleges this limitation is disclosed in Hodgson "(Figure 1 , Paragraphs 62, 34, 
and 72, wherein the ACS is the merchant server and the STMS 30 and 20, 22)" (Office Action 
Page 4). Figure 1 discloses a merchant web server (20,22) configured to request a passcode, 
where the merchant web server builds a payment web page and sends it to the consumer (12). 
{Hodgson Fig. 1, P[0066-0068]). Figure 1 discloses a Secure Transaction Management Server 
(STMS, 30) configured to receive a request for passcode authentication of a PAN where the 
STMS (30) receives the passcode entered by the consumer in order to authenticate the passcode. 
(Hodgson Fig. 1, P[0076-0080]. Figure 1 does not disclose an Access Control Server configured 
to both receive a request for authentication and also to request authentication of a passcode 
corresponding to a PAN. 

Furthermore, this limitation would not be obviated by Hodgson, alone or in combination 
with any art of record. Combination of the Merchant Web Server (20,22) and the Secure 
Transaction Management Server (30) would result in the invention in Hodgson becoming 
inoperative because payment information, such as the passcode, would be sent to the merchant. 
An advantage of Hodgson, as stated in Hodgson, is that no payment information is sent to the 
merchant. (Hodgson P[0093]). 

As another example, Claim 1 recites: 

a front end Hardware Security Module (HSM) coupled to the ACS, and 
configured to receive the passcode in an encrypted format and generate an 
encrypted passcode using a local encryption key 

(emphasis added). The Office Action alleges this limitation is taught in Hodgson paragraphs 58, 
59, 73, 92, 154, and Figure 1. (Office Action page 4). Based on these paragraph citations, it 
appears that the Office Action is equating the front end HSM with the PinPad as disclosed in 
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Hodgson. However, the PinPad does not receive the passcode in an encrypted format. The 
PinPad receives the passcode in a clear format, when the user types it in. The PinPad's function 
is to encrypt the passcode. (Hodgson P[0072-0073]). As was discussed in the examiner 
interview, typing the passcode into the PinPad by a user is not entering it in an encrypted format. 

Therefore, for the reasons presented above, Claim 1 is allowable because it is neither 
anticipated nor obviated by Hodgson. Furthermore, Claims 2-8, 10-15, and 33 are allowable by 
virtue of their dependence from Claim 1 . 

Claim 16 

Claim 16 contains limitations that are very similar to the limitations found in claim 1. As 
such, the argument that was presented above with regard to Claim 1 is applicable to Claim 16. 
Furthermore, Claim 17 is allowable by virtue of its dependence from Claim 16. 

Claim 19 

Each and every limitation of Claim 19 is not disclosed in Hodgson. For example, Claim 
19 recites receiving an encrypted PIN in a front end Hardware Security Module (HSM) in 
response to the request, (emphasis added). The Office Action alleges this is disclosed in 
Hodgson, paragraph 62. (Office Action Page 7). Although paragraph 62 of Hodgson may 
disclose an HSM, it does not disclose a front end HSM receiving an encrypted PIN. As with the 
argument for Claim 1 , the Office Action is equating the front end HSM with the PinPad. As has 
been discussed previously, the PinPad in Hodgson does not receive an encrypted PIN, it receives 
a clear PIN. 

Therefore, for the reasons presented above, Claim 1 9 is allowable because it is not 
anticipated by Hodgson. Furthermore, Claims 20-27 are allowable by virtue of their dependence 
from Claim 19. 
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Claim 28 

Claim 28 contains limitations that are very similar to the limitations found in claim 19. 
As such, the argument that was presented above with regard to Claim 19 is applicable to Claim 
28. Furthermore, Claims 29-31 are allowable by virtue of their dependence from Claim 28. 

Claim 32 

Claim 32 contains limitations that are very similar to the limitations found in Claims 1 
and 16. As such, the argument that was presented above with regard to Claim 1 is applicable to 
Claim 32. 

Claim Rejections 35 USC § 103(a). Hodgson. Morrill 

Claims 18, 21, 33, and 34 are rejected as being unpatentable over Hodgson in view of 
Morrill, Jr. (US. Patent No. 5, 991, 7 '49)(" Morrill"). This rejection is traversed. Hodgson and 
Morrill, alone or in combination, fail to teach or suggest each and every limitation of these 
Claims. 

Claim 18 

The Office Action alleges that each and every limitation of Claim 18 is taught by 
Hodgson and Morrill in combination. The Office Action alleges that all the limitations of Claim 
18, except for "the request for the PIN including an instruction to provide the PIN to a 
destination address," are taught by Hodgson, and are rejected under the same basis as used in the 
rejection of Claim 1. (Office Action Page 8). The Office Action alleges that "the request for the 
PIN including an instruction to provide the PIN to a destination address, " is taught by Morrill. 
(Office Action Page 8-9). 

The argument presented above with regard to Claim 1 applies to Claim 1 8 with respect to 
those limitations alleged to be taught by Hodgson. 

The Office Action admits the limitation "the request for the PIN including an instruction 
to provide the PIN to a destination address," is not present in Hodgson, but alleges that it is an 
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inherent property. The Office Action further states that even if this limitation is not inherent, it is 
taught by Morrill. 

"In relying upon the theory of inherency, the examiner must provide a basis in fact and/or 
technical reasoning to reasonably support the determination that the allegedly inherent 
characteristic necessarily flows from the teachings of the applied prior art." Ex parte Levy, 17 
USPQ2d 1461, 1464 (Bd. Pat. App. & Inter. 1990) (emphasis in original) MPEP 2112. The 
Office Action alleges that because the PIN may go to different entities, such as the STMS or 
POS processors, providing a destination address is an inherent characteristic. However, 
providing a destination address does not necessarily flow from the teachings of the applied prior 
art. For example, in Figure 1 of Hodgson, the PIN may be entered into the PinPad. The PinPad 
is only connected to the consumer's computer. As such, the PinPad does not require an 
instruction with a destination address, because there is no other destination other than the 
consumer's computer. No instruction with a destination address is necessary . 

The Office Action further alleges that even if "the request for the PIN including an 
instruction to provide the PIN to a destination address" is not an inherent property, it is taught 
by Morrill. However, Morrill does not teach a destination address for a PIN, but rather it teaches 
a destination account for funds to be transferred to. (Morrill, col. 2, line 60-col. 3, line 5). In 
combination, this would result in the request for a PIN, as disclosed in Hodgson, resulting in 
funds being transferred to a destination account, as disclosed in Morrill. This resultant 
combination does not make sense in the context of the present application. 

As such, Claim 18 is allowable because each and every limitation is not taught by 
Hodgson and Morrill, alone or in combination. 

Claim 21 

Claim 21 is rejected under the same reasoning as presented in Claim 18. In addition to 
being allowable by virtue of its dependence from claim 19, Claim 21 is also allowable for the 
same reasons as presented above, with respect to Claim 18. 
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Claim 33 

Claim 33 is allowable at least by virtue of its dependence from Claim 1 . 
Claim 34 

Claim 34 is allowable at least by virtue of its dependence from Claim 18. Furthermore, 
the Office Action has failed to make a prima facie case describing where in either reference it is 
shown that "the instruction to provide a PIN to a destination address is an HTTP redirect 
instruction." The Office Action refers generically to HTTP addresses, however, HTTP redirect 
is not a generic term used to describe general HTTP activities. HTTP redirect is a specific 
command in the HTTP protocol. The Office Action has failed to show where "the instruction to 
provide a PIN to a destination address is an HTTP redirect instruction" is shown in either 
Hodgson or Morrill, alone or in combination. 

Suggestion to Amend Claim Language 

Applicants have fully considered the Examiners' suggestion to amend the claim language 
regarding a "Hardware Security Module" to clarify that it is hardware. Applicants feel that such 
an amendment is not required at this time as this would be readily known to one of skill in the 
art. However, if this is the sole obstacle to allowance, Applicants would be willing to either 
make such an amendment or allow such an amendment to be entered as an Examiner 
amendment. 
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CONCLUSION 

In view of the foregoing, Applicants believe all claims now pending in this 
Application are in condition for allowance. The issuance of a formal Notice of Allowance at an 
early date is respectfully requested. 

If the Examiner believes a telephone conference would expedite prosecution of 
this application, please telephone the undersigned at 415-576-0200. 



Respectfully submitted, 

/ Preetam B. Pagar / 

Preetam B. Pagar 
Reg. No. 57,684 

TOWNSEND and TOWNSEND and CREW LLP 

Two Embarcadero Center, Eighth Floor 

San Francisco, California 941 1 1-3834 

Tel: 415-576-0200 

Fax: 415-576-0300 
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